Attribution of a new application installation on a mobile device by analyzing network traffic of the device

ABSTRACT

A system determines attribution of an application install on a mobile device that includes a virtual private network (VPN) application. An application executing on a mobile device may display a third party application advertisement. The VPN application detects a click on the third party application advertisements by monitoring the network requests and records a display time of the advertisement. Further, it detects the download and installation of the third party application by monitoring the network requests and comparing it against a rule from the rules dictionary, and records the installation time of the third party application. If the installation time is within a predetermined threshold time of the display time of the third party application advertisement, an attribution count is updated and is reported to an analytics engine.

BACKGROUND

This invention relates generally to the field of attribution of mobileapplication installations on a mobile device, and in particular toattribution by a network access application running on the mobile devicethat analyzes the device's network traffic to detect impressions.

Mobile devices such as mobile phones and tablets have many mobileapplications installed on them. Many mobile applications are free todownload or charge a minimal fee for downloading the application. Mobileapplications often make money by advertising within their application,which advertising is often encouraging a user to install additionalmobile applications on the device. The applications that provide theadvertising may be referred to as publisher applications, as theypublish ads to the user. A publisher application may be paid for servingads in a variety of ways. For example, some publisher applications arepaid for an impression, which occurs when the publisher applicationdisplays a particular content item (e.g., an advertisement) within themobile application. In other examples, the publisher application is paidwhen a user takes an action following the impression, such as a click onthe third party application advertisement, an installation of anothermobile application, or any other observable other user event.

It is often desirable to measure the effectiveness of a marketingcampaign on a mobile application. For marketing campaigns where the goalis for the user to install an application on the mobile device,measuring the effectiveness of a campaign may involve detecting that amobile application was installed following an impression of a particularadvertisement. The installation is a conversion event, which isattributed to the impression according to an attribution model.

Detecting the impression and conversion and applying the attributionmodel is typically accomplished by the publisher application and/or thead server. However, an entity that is not directly involved in theadvertisement process or otherwise affiliated with it typically has noway of determining whether an installation of a mobile applicationoccurred due to an impression, in part because the entity has novisibility into the impression and or conversions. This technicallimitation prevents such third party entities from computing independentanalytics about application installations on a mobile device.

SUMMARY

Embodiments of the invention enable a system to compute analytics aboutapplication installations on a mobile device without being directlyinvolved in the installation or any impressions to which theinstallation is attributed. For example, a network access application,such as a virtual private network (VPN) application, is provided by anentity that desires to compute analytics about application installationson the mobile device. The VPN application allows a user to securelyaccess mobile applications included in a private network, for example,email application from an employer, documents residing on an employerserver, and other such applications. Additionally, the VPN applicationenables access to other mobile applications that are not a part of theprivate network and allows the other mobile applications to send andreceive data across shared or public networks, such as the Internet. Thedata or requests from the other mobile applications are sent via aprivate network interface of the VPN application.

The VPN application inspects data packets from one or more publisherapplications executing on the mobile device to track impressions of adsthat may be displayed by publishing application on the mobile device.More specifically, the VPN application tracks impressions by analyzingthe network traffic of the publishing applications on the device. TheVPN application queries the operating system of the client deviceperiodically to determine when a new application is installed. If a newapplication is installed, the VPN application or a server that collectsthe data from the VPN application may apply an attribution model todetermine if the new application install can be attributed to one ormore ad impressions.

The VPN application may inspect the network requests to determine apattern that represents a publisher application. The VPN application maystore this pattern and use it later to detect one or more impressions ofthe advertisement (generally termed as an ad) by determining that thenetwork requests were made by one of the publisher applications to anetwork address associated with the ad. Locating the network address ofassociated with an ad is one way of detecting an ad impression. An adimpression may be detected in other ways such as display of a particularad or determining a location of a particular publishing application thatcan retrieve an ad.

The VPN application logs the detected impressions and their associatedpublisher application. Further, on a new application install, the VPNapplication logs a time of installation of the new application. Theattribution model may link the application install to one or moreimpressions by comparing the time of installation of the new applicationto the time the ad impressions were logged. If the installation of anapplication occurs within a threshold time of the one or moreimpressions, the attribution model attributes the installation of theapplication to the logged impression and reports the determinedattribution to an analytics engine.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating a computing environment forapplication install attribution according to one embodiment of thepresent disclosure.

FIG. 2 is a block diagram illustrating logical components of anapplication install attribution module according to one embodiment ofthe present disclosure.

FIG. 3 is a flow diagram illustrating a method for determining anattribution count for an advertised application according to oneembodiment of the present disclosure.

The figures depict various embodiments of the present invention forpurposes of illustration only. One skilled in the art will readilyrecognize from the following discussion that alternative embodiments ofthe structures and methods illustrated herein may be employed withoutdeparting from the principles of the invention described herein.

DETAILED DESCRIPTION

Overview

FIG. 1 is a block diagram illustrating a computing environment forapplication install attribution according to one embodiment of thepresent disclosure. The computing environment 100 shown by FIG. 1comprises one or more client devices 106, a network 102, one or moremobile application stores 104, an application rule dictionary 110 and anapplication install attribution module 108. In alternativeconfigurations, different and/or additional components may be includedin the system environment 100.

The client devices 106 are one or more computing devices capable ofreceiving user input as well as transmitting and/or receiving data viathe network 102. In one embodiment, a client device 106 is a smartphone,a tablet or a conventional computer system, such as a desktop or laptopcomputer. Alternatively, a client device 106 may be a device havingcomputer functionality that accesses a set of mobile applications. Aclient device 106 is configured to communicate via the network 102. Inone embodiment, a client device 106 executes an application allowing auser of the client device 106 to interact with the application installattribution module 108. For example, a client device 106 executes abrowser application to enable interaction between the client device 106and the application install attribution module 108 via the network 102.In another embodiment, a client device 106 interacts with theapplication install attribution module 108 through an applicationprogramming interface (API) running on a native operating system of theclient device 106, such as IOS® or ANDROID™.

The client devices 106 are configured to communicate via the network102, which may comprise any combination of local area and/or wide areanetworks, using both wired and/or wireless communication systems. In oneembodiment, the network 102 uses standard communications technologiesand/or protocols. For example, the network 102 includes communicationlinks using technologies such as Ethernet, 802.11, worldwideinteroperability for microwave access (WiMAX), 3G, 4G, code divisionmultiple access (CDMA), digital subscriber line (DSL), etc. Examples ofnetworking protocols used for communicating via the network 102 includemultiprotocol label switching (MPLS), transmission controlprotocol/Internet protocol (TCP/IP), hypertext transport protocol(HTTP), simple mail transfer protocol (SMTP), and file transfer protocol(FTP). Data exchanged over the network 120 may be represented using anysuitable format, such as hypertext markup language (HTML) or extensiblemarkup language (XML). In some embodiments, all or some of thecommunication links of the network 102 may be encrypted using anysuitable technique or techniques. In one embodiment, the network 102includes a VPN store.

One or more mobile application stores 104 may be coupled to theapplication install attribution module 108 that monitors the applicationstores to determine a download and install of a mobile application onthat client device 106. A mobile application store 104 includesdownloadable mobile applications and catalogs for the mobileapplications. Exemplary mobile application stores include the Apple iOSStore, Google Play store, Amazon application store, Mac applicationstore, Windows application store and other such stores.

The application rule dictionary 110 stores rules (e.g., regularexpressions) associated with a mobile application, for example, apublisher application. To determine a rule, a VPN application downloadsand installs a mobile application on a test client device 106. The testclient device executes only the VPN application and the mobileapplication to ensure that the traffic on the network interface flowsfrom the executing application. The VPN application monitors the testclient device's 106 network traffic and identifies key patternsindicating a request to access an application store 106. In addition, aunique pattern is identified for each action such as download,re-download or update of a mobile application when accessing theapplication store 106. A unique string is identified for an applicationicon that is a part of the monitored network request. A rule identifyingeach of the actions, the request to an application store and anapplication icon are parsed from the network requests and stored in theapplication rule dictionary 110. The rules are used in future to eventssuch as a download, update or re-download of an application or a requestto the application store 104.

The application install attribution module 108 determines an attributionof an application installation to one or more impressions on a clientdevice 106. The VPN application on the client device 106 monitorsnetwork requests and determines if the network requests are from a knownpublisher application. The application rules dictionary 110 may be usedto search for a pattern associated with the network request. A mobileapplication executing on a client device 106 may display an ad for athird party application. The application install attribution module 108monitors the network request from the executing mobile application todetect an ad impression by determining that the network requests weremade by one of the known publisher applications to a network addressassociated with the ad. The network address associated with the ad maybe obtained by looking at the landing page of the third partyapplication.

Simultaneously, the application install attribution module 108 mayperiodically monitor the operating system of the client device 106 todetect a request to download and/or install a mobile application from anapplication store 104. Once a download or an install request isdetected, the application install attribution module 108 logs the timeof install of the mobile application on the client device 106. Anattribute of the installed mobile application, such as an applicationicon, may be compared with a similar attribute of the landing page ofthe third party application to determine that the installed applicationis the same as the application displayed by the landing page.

Further, the logged installation time of the downloaded and installedapplication is compared to the logged impression time of the ad. If theinstallation time is within a predetermined threshold time of theimpression time, for example, if the downloaded and installedapplication was installed within 30 seconds of the display of theadvertisement, the attribution install model attributes the installationto the ad impression. The attribution count is updated and stored in adatabase. The attribution count is reported to an analytics engine. Theanalytics engine may aggregate the attributions across many devices andaggregate into a report that shows conversion information acrossmultiple ads, publishing apps and other such attributes.

FIG. 2 is a block diagram illustrating logical components of anapplication install attribution module according to one embodiment ofthe present disclosure. The application install attribution module 108includes a network requests monitor 210 that can retrieve data from anapplication rules dictionary 110, an advertisement (ad) detection module215, an app store interaction detection module 220, a comparator module240 and an attribution determination and notification module 245.

One or more mobile applications execute on a client device 106 thatcreate network traffic over the VPN network interface. The networkrequests monitor 210 monitors the traffic and analyzes each networkrequest. The network requests are analyzed to determine which mobileapplication is executing on the client device 106. To determine whichmobile application is executing, the network requests monitor 210 maysearch for rule in the application rule dictionary 110 that matches apattern of the monitored network request. If a match is found, theassociated mobile application name is retrieved from the ruledictionary. The executing mobile application identifier is sent to thead detection module 215 to determine if a third-party applicationadvertisement was displayed while the mobile application was executing.

The ad detection module 215 receives the executing mobile applicationidentifier and the monitored requests. The ad detection module 215analyzes the network request to detect an http request to a landing pagedifferent than the executing mobile application. If an http request isfound, the ad detection module 215 determines that a third partyapplication advertisement was displayed and clicked within the executingmobile application. The ad detection module 215 records a time ofdisplay of the third party application advertisement and sends it to thecomparator module 240.

An app store interaction detection module 220 detects interactions bythe device 106 with one of the application stores 104. The interactionsmay include, for example, a download and install of an application fromone of the application stores 104, a search on an application store 104using one or more search terms, a download of a page on which a searchresult has appeared, a web search using a specific search term, or anyother interaction that may be tracked by the module 220. Morespecifically, the app store interaction detection module 220 receivesmonitored network requests. The network requests are parsed to identifykey patterns in the requests via specific rules (regular expressions)that represent a request to an application store 104. The app storeinteraction detection module 220 may search for rule in the applicationrule dictionary 110 that matches a pattern of the monitored networkrequest indicating a request to an application store 104. An applicationstore 104 name may be retrieved from the application rule dictionary110.

Once an application store 104 is determined, the app store interactiondetection module 220 may further parse the monitored requests, viaspecific rules (e.g., search within the identified application namerules), to identify the type of action that the monitored requestincludes. In the example of detecting a download and install of anapplication, the pattern of the monitored network request may indicate adownload and install request to an application store 104, an uploadrequest to an application store 104, or an update request to anapplication store. If a request to download an application from theapplication store 104 is detected, the app store interaction detectionmodule 220 records a time of download and installation of theapplication and forward it to the comparator module 240.

The comparator module 240 compares the application icon of the installedapplication is compared to the landing page of the third party mobileapplication advertisement. If the application icon of the installedapplication is same as the application icon displayed on the landingpage of the third party mobile application, the comparator compares thetime of display of a third party mobile application advertisement to thedownload and installation time of a mobile application. The comparatormodule 240 notifies the attribution determination module 245 of theresult of the comparison.

If the download and install time of the mobile application is within apredetermined threshold time of the display of the third party mobileapplication advertisement, the attribution determination andnotification module 245 updates an attribution count associated with thethird party mobile application advertisement. For example, if the mobileapplication is downloaded and installed within 30 seconds of the displayof the third party mobile application advertisement, it is inferred thatthe installation is a result of the display of the third party mobileapplication advertisement, and hence an attribution count, such as aconversion count or an application install count, may be updated orincremented to reflect the attribution. An application analytics engineis notified of the attribution count by the attribution determinationand notification module 245.

FIG. 3 is a flow diagram illustrating a method for determining anattribution count for an advertised application according to oneembodiment of the present disclosure. The application installattribution module 108 monitors 302 the network requests from one ormore mobile applications executing on a client device 106. The executingmobile application may display third-party mobile applicationadvertisements. The monitored network requests are analyzed to detect304 an interaction with the third party application advertisement (e.g.,an impression or click) by determining a landing page portion within themonitored network request. The time of display of the third partyapplication advertisement is recorded on detection of the click.

Simultaneously, the application install attribution module 108 monitorsthe network requests to detect 306 a download and installation of amobile application. The downloaded application is compared to the thirdparty application displayed by the advertisement to verify that thedownloaded and installed application is the third party application, forexample, an application icon of the downloaded mobile application may becompared to the application icon displayed on the landing page of thethird party application to ensure a match. On verification that thedownloaded and installed application is the third party application, adownload and installation time of the third party application isdetermined 308.

The download and installation time of the third party application iscompared 310 to the display time of the third party applicationadvertisement. If the download and installation time is within 312 apre-determined threshold time of the display time, an attribution count,for example, a conversion count, for the third party application isupdated 314. In other embodiments, other attribution models may be used.If the download and installation time is not within the pre-determinedthreshold time of the display time, the attribution count is notupdated. In either case, the attribution count is reported 316 to ananalytics engine. The analytics engine may further use to analyze theresults of marketing via the display of third party applicationadvertisements.

Additional Considerations

The foregoing description of the embodiments of the invention has beenpresented for the purpose of illustration; it is not intended to beexhaustive or to limit the invention to the precise forms disclosed.Persons skilled in the relevant art can appreciate that manymodifications and variations are possible in light of the abovedisclosure.

Some portions of this description describe the embodiments of theinvention in terms of algorithms and symbolic representations ofoperations on information. These algorithmic descriptions andrepresentations are commonly used by those skilled in the dataprocessing arts to convey the substance of their work effectively toothers skilled in the art. These operations, while describedfunctionally, computationally, or logically, are understood to beimplemented by computer programs or equivalent electrical circuits,microcode, or the like. Furthermore, it has also proven convenient attimes, to refer to these arrangements of operations as modules, withoutloss of generality. The described operations and their associatedmodules may be embodied in software, firmware, hardware, or anycombinations thereof.

Any of the steps, operations, or processes described herein may beperformed or implemented with one or more hardware or software modules,alone or in combination with other devices. In one embodiment, asoftware module is implemented with a computer program productcomprising a computer-readable medium containing computer program code,which can be executed by a computer processor for performing any or allof the steps, operations, or processes described.

Embodiments of the invention may also relate to an apparatus forperforming the operations herein. This apparatus may be speciallyconstructed for the required purposes, and/or it may comprise ageneral-purpose computing device selectively activated or reconfiguredby a computer program stored in the computer. Such a computer programmay be stored in a non-transitory, tangible computer readable storagemedium, or any type of media suitable for storing electronicinstructions, which may be coupled to a computer system bus.Furthermore, any computing systems referred to in the specification mayinclude a single processor or may be architectures employing multipleprocessor designs for increased computing capability.

Embodiments of the invention may also relate to a product that isproduced by a computing process described herein. Such a product maycomprise information resulting from a computing process, where theinformation is stored on a non-transitory, tangible computer readablestorage medium and may include any embodiment of a computer programproduct or other data combination described herein.

Finally, the language used in the specification has been principallyselected for readability and instructional purposes, and it may not havebeen selected to delineate or circumscribe the inventive subject matter.It is therefore intended that the scope of the invention be limited notby this detailed description, but rather by any claims that issue on anapplication based hereon. Accordingly, the disclosure of the embodimentsof the invention is intended to be illustrative, but not limiting, ofthe scope of the invention, which is set forth in the following claims.

What is claimed is:
 1. A method for attributing an application installon a device, the method comprising: monitoring network traffic includingnetwork requests from one or more publisher applications on a mobiledevice, wherein the one or more publisher applications display anadvertisement for a third-party application; detecting one or moreimpressions of the advertisement by determining that the networkrequests were made by one of the publisher applications to a networkaddress associated with the advertisement; logging the detectedimpressions and their associated publisher applications; detecting aninstallation of the third-party application on the mobile device,wherein the installation is detected by: searching a rules dictionaryfor a rule having a regular expression that identifies a request toaccess an application store and applying the rule to the monitorednetwork traffic to find a match; and identifying an installation eventfor the third-party application, from the matched monitored networktraffic, by comparing an installation event identifier of the rule tothe matched monitored network traffic; logging a time of theinstallation of the third-party application on the mobile device;determining an attribution of the installation of the third-partyapplication to one or more of the impressions by applying an attributionmodel to the logged installation and the logged impressions; andreporting the determined attribution to an analytics engine.
 2. Themethod of claim 1, wherein detecting an advertisement further includesdetecting a network request to the mobile application displayed in theadvertisement.
 3. The method of claim 2, further comprising determininga landing page for the detected network request to the mobileapplication.
 4. The method of claim 1, further comprising storing in arules dictionary, a rule for identifying a request to access anapplication store by an application that executes on a mobile device,where each rule further includes an identifier for an event associatedwith the request to access an application store.
 5. The method of claim4, wherein the event includes at least one of a download, install,upload or a re-download event.
 6. The method of claim 1, whereindetecting a third party application installation further comprises:extracting an icon from the advertisement; and comparing the iconextracted from the advertisement with an icon of an applicationinstalled on the mobile device.
 7. A computer program product forattributing an application install on a device, the computer programproduct comprising a non-transitory computer-readable storage mediumcontaining computer program code for: monitoring network trafficincluding network requests from one or more publisher applications on amobile device, wherein the one or more publisher applications display anadvertisement for a third-party application; detecting one or moreimpressions of the advertisement by determining that the networkrequests were made by one of the publisher applications to a networkaddress associated with the advertisement; logging the detectedimpressions and their associated publisher applications; detecting aninstallation of the third-party application on the mobile device,wherein the installation is detected by: searching a rules dictionaryfor a rule having a regular expression that identifies a request toaccess an application store and applying the rule to the monitorednetwork traffic to find a match; and identifying an installation eventfor the third-party application, from the matched monitored networktraffic, by comparing an installation event identifier of the rule tothe matched monitored network traffic; logging a time of theinstallation of the third-party application on the mobile device;determining an attribution of the installation of the third-partyapplication to one or more of the impressions by applying an attributionmodel to the logged installation and the logged impressions; andreporting the determined attribution to an analytics engine.
 8. Thecomputer program product 7, wherein detecting an advertisement furtherincludes detecting a network request to the mobile application displayedin the advertisement.
 9. The computer program product 8, furthercomprising determining a landing page for the detected network requestto the mobile application.
 10. The computer program product 7, furthercomprising storing in a rules dictionary, a rule for identifying arequest to access an application store by an application that executeson a mobile device, where each rule further includes an identifier foran event associated with the request to access an application store. 11.The computer program product 10, wherein the event includes at least oneof a download, install, upload or a re-download event.
 12. The computerprogram product 7, wherein detecting a third party applicationinstallation further comprises: extracting an icon from theadvertisement; and comparing the icon extracted from the advertisementwith an icon of an application installed on the mobile device.